Do you have some sort of way of telling in the origin that a user is “impersonated” vs “really the user”?
If so the simplest thing here is to just have your SSO endpoint explode for impersonated cases.
Do you have some sort of way of telling in the origin that a user is “impersonated” vs “really the user”?
If so the simplest thing here is to just have your SSO endpoint explode for impersonated cases.